VICIdial vulnerabilities
We track 5 vulnerabilities in VICIdial products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 10, 2024.
Latest VICIdial vulnerabilities
- 8.8 High severity
VICIdial: Improper Neutralization of Special Elements used in an OS Command
An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. This attack can be chained with CVE-2024-8503 to execute arbitrary shell commands starting from an unauthenticated perspective.
- 9.8 Critical severity
VICIdial: Improper Neutralization of Special Elements used in an SQL Command
An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. By default, VICIdial stores plaintext credentials within the database.
- 8.8 High severity
VICIdial: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in User Stats interface (/vicidial/user_stats.php) of VICIdial via the file_download parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destroy the data o
- 8.8 High severity
VICIdial: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in AST Agent Time Sheet interface ((/vicidial/AST_agent_time_sheet.php) of VICIdial via the agent parameter allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all data on the system, destr
- 8.8 High severity
VICIdial: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in admin interface (/vicidial/admin.php) of VICIdial via modify_email_accounts, access_recordings, and agentcall_email parameters allows attacker to spoof identity, tamper with existing data, allow the complete disclosure of all dat